Extended Key Usages
ExtKeyUsageCodeSigning
Static task
static1
Behavioral task
behavioral1
Sample
d87d62e105f1e37ef5f02d69a9cdcc26c73e1cbb7fdf08477e070cc32120a938.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
d87d62e105f1e37ef5f02d69a9cdcc26c73e1cbb7fdf08477e070cc32120a938.dll
Resource
win10v2004-20240226-en
Target
d87d62e105f1e37ef5f02d69a9cdcc26c73e1cbb7fdf08477e070cc32120a938
Size
1.6MB
MD5
8765e4dd0b151b8693dd196f4cf96a27
SHA1
df7a2e86132e80105eb9834521e2f0a3008a0748
SHA256
d87d62e105f1e37ef5f02d69a9cdcc26c73e1cbb7fdf08477e070cc32120a938
SHA512
164f892aeae57e5bca1cd03de07f15f2f4e721b9e4a0d56e3a2b53ca3ab05185cb2220064efc6c52906d0be2135e08bdec2e4369ce431b979dcf63f2db2ff021
SSDEEP
24576:0UOdqR7QeAfuSlpUKj5LKybCmyqECxZ+JLYnE0WO6JBX4q:0UOdqR+p5LKsCr+/COC4q
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
winload_prod.pdb
AhCreateLoadOptionsString
AhGetArcDevice
ArchBuildKernelGdt
ArchGetGdtRegister
BlAllocateSlabPages
BlAmdSlGetEnabledFeatures
BlAmdSlGetTaCommands
BlAmdSlGetTaParameterRegisters
BlAppCheckDependency
BlAppSetDependency
BlAppendBootOptionBoolean
BlAppendBootOptionString
BlAppendUnicodeToString
BlArchCpuId
BlArchDetectSmt
BlArchGetCpuVendor
BlArchGetPerformanceCounter
BlArchIsCpuIdFunctionSupported
BlArchIsFiveLevelPagingActive
BlArchIsShadowStackSupported
BlArchKernelSetup
BlArchQueryIoPortAccessSupported
BlArchSetSecrets
BlBdDebugTransitionsEnabled
BlBdDebuggerConnected
BlBdGetBootDebugDevice
BlBdGetExtensionName
BlBdGetHvDebugDevice
BlBdGetMacAddressFromSmBiosUuid
BlBdGetPciDevicePath
BlBdInitializeDeviceDescriptor
BlBdInitializeDeviceDescriptorEx
BlBdInitializeTransportExtension
BlBdLoadImageSymbols
BlBdPatchIdt
BlBdReleaseDebuggingDevice
BlBdSetupDebugDevice
BlBdSetupDebuggingDevice
BlBdStart
BlBdStop
BlBdUpdateSharedHypervisorDebugDevice
BlBootOptionExists
BlBsdCloseLog
BlBsdLogEntry
BlCopyBootOptions
BlCopyStringToUnicodeString
BlCopyStringToWcharString
BlCopyUnicodeStringToUnicodeString
BlCopyWcharStringToString
BlDeviceClose
BlDeviceCompare
BlDeviceGetInformation
BlDeviceGetIoInformation
BlDeviceOpen
BlDeviceSetInformation
BlDisplayFreeOemBitmap
BlDisplayGetOemBitmap
BlDisplayInvalidateOemBitmap
BlEnNotifyEvent
BlFileClose
BlFileCopyFile
BlFileExists
BlFileGetInformation
BlFileLoad
BlFileOpen
BlFileReadAtOffsetEx
BlFileReadEx
BlFileSetInformation
BlFileWrite
BlFveCheckPermission
BlFwGetAcpiMemoryMap
BlFwGetSystemTable
BlFwQueryEfiRuntimeVaRange
BlFwReboot
BlFwServicesAvailable
BlGetApplicationEntry
BlGetApplicationIdentifier
BlGetBootDevice
BlGetBootOptionBoolean
BlGetBootOptionDevice
BlGetBootOptionInteger
BlGetBootOptionString
BlGetDevice
BlGetDeviceIdentifier
BlGetExecutionEnvironment
BlGetLogicalProcessorCount
BlGetProcessorApicIds
BlImgFindSection
BlImgGetNtHeader
BlImgGetPEImageSize
BlImgGetSigningPolicy
BlImgGetWhqlEnforcementDateTime
BlImgIsBootUpgradedPlatform
BlImgIsUpgradeInProgress
BlImgIsUpgradedPlatform
BlImgIsWhqlDeveloperTestModeEnabled
BlImgIsWhqlDisabledBySetting
BlImgIsWhqlEnabledBySetting
BlImgIsWinPE
BlImgLoadImageWithProgress2
BlImgLoadPEImageEx
BlImgLoadPEImageWithPolicyValidatedHash
BlImgParseOsRevocationList
BlImgQueryCodeIntegrityBootOptions
BlImgRegisterCodeIntegrityCatalogDirectory
BlImgRegisterCodeIntegrityCatalogs
BlImgRsaKnownAnswerTest
BlImgSetRestrictedSigning
BlImgSetSigningPolicy
BlImgSetSysDevWhqlPolicy
BlImgSha1KnownAnswerTest
BlImgSha1MonteCarloTest
BlImgTrustCustomSignersForDrivers
BlImgUnLoadImage
BlImgVerifyFontIntegrity
BlIpmiDestroy
BlIpmiGetHwConfig
BlIpmiInitialize
BlIpmiLogCheckPoint
BlLdrBuildImagePath
BlLdrFreeDataTableEntry
BlLdrLoadDll
BlLdrLoadImage
BlLdrPreloadFile
BlLdrPreloadImage
BlLdrUnloadImage
BlLogDestroy
BlLogDiagWrite
BlLogEtwRegister
BlLogEtwWrite
BlLogEtwWriteTransfer
BlLogInitialize
BlLogIsVerboseSELEnabled
BlMmAddEnclavePageRange
BlMmAddPersistentPageRange
BlMmAllocateHeap
BlMmAllocatePages
BlMmAllocatePagesInRange
BlMmAllocatePartitionPhysicalPagesInRangeNuma
BlMmAllocatePhysicalPages
BlMmAllocatePhysicalPagesInRange
BlMmAllocatePhysicalPagesInRangeNuma
BlMmAllocateVirtualPages
BlMmClosePartition
BlMmDisableStaticDescriptors
BlMmDisableUpdates
BlMmEnableStaticDescriptors
BlMmEnableUpdates
BlMmEnumerateAllocations
BlMmFlushTlb
BlMmFreeHeap
BlMmFreePages
BlMmFreePartitionRangeAllocation
BlMmFreePhysicalPages
BlMmFreeVirtualPages
BlMmGetAllocationPages
BlMmGetMemoryMap
BlMmInitMemoryMapHandle
BlMmIsLargePageMapping
BlMmMapIoSpace
BlMmMapPhysicalAddress
BlMmMapPhysicalAddressEx
BlMmOpenPartition
BlMmPersistAllocation
BlMmProcessBadPageList
BlMmQueryLargePageSize
BlMmQueryTranslationType
BlMmRegisterPledgedType
BlMmReleaseMemoryMap
BlMmRemapVirtualAddress
BlMmSetPageProtection
BlMmTranslateEfiMemoryType
BlMmTranslateVirtualAddress
BlMmUnmapVirtualAddress
BlMmUnmapVirtualAddressEx
BlMmUnpersistAllocation
BlMmUnpersistAllocations
BlMmUnprotectAllocation
BlMmUnregisterPledgedType
BlMmUpdatesDisabled
BlMmWalkPageTable
BlMmWriteZeroPte
BlNumaGetNumaMemoryRanges
BlObtainUnusedSlabPages
BlPdAllocateData
BlPdDestroyData
BlPdFreeData
BlPdPersistAllocations
BlPdQueryData
BlPdQueryDataAll
BlPdSaveData
BlPltReadPciConfig
BlPltWritePciConfig
BlRdUnmap
BlRemoveBootOption
BlResourceFindDataFromImage
BlResourceFindMessage
BlResourceGetLanguageMapping
BlSIPolicyCheckPolicyOnDevice
BlSIPolicyDoesActivePolicyGrantPermission
BlSIPolicyLoadAndActivateTemporalPolicy
BlSealSecretToCurrentPcrValues
BlSecureBootGetNonVolatilePrivateVariable
BlSecureBootIgnoreSingleBootOption
BlSecureBootSetVolatilePrivateVariable
BlSetVirtualizationLaunched
BlSiAppLosingTpmAccess
BlSiCloseEnvironment
BlSiEnterInsecureStateEx
BlSiEnvironmentReady
BlSiFlushCurrentMeasurements
BlSiHandleHypervisorLaunchEvent
BlSiLeaveEnvironment
BlSiMeasureOsRevocationList
BlSiPaRecordConfigEvent
BlSiPaRecordDrtmConfigEvent
BlSiPaRecordEvent
BlSiSetDrtmEnvironmentUnsafe
BlStatusError
BlStatusPrint
BlStatusRegisterErrorHandler
BlSvnGetApplicationSvn
BlSvnGetChainStatus
BlSymCryptGetAesBlockCipher
BlSymCryptGetHmacSha256Algorithm
BlTblSetEntry
BlTcbIsDrtmCapable
BlTcgFwSetAndLockMemoryOverwriteRequestControl
BlTimeGetRelativeTime
BlTimeQueryPerformanceCounter
BlTpmGetRandom
BlTpmShutdown
BlTpmStatus
BlTxtGetRlpParkPage
BlTxtGetTprArray
BlUpdateBootOptions
BlUtlCheckSum
BlUtlGetAcpiTable
BlUtlGetAcpiTableOverrides
BlUtlPopulateAcpiTableCache
BlUtlReleaseAcpiTable
BlUtlSetAcpiTableOverrides
BlUtlValidateMemoryRange
BlValidateAmeCertChain
BlVsmCheckSystemPolicy
BlVsmGetSystemPolicy
BlVsmKeysFindKeyMapByType
BlVsmKeysGetCurrentLKeyRefFromArray
BlVsmKeysGetCurrentLKeyRefFromPkg
BlVsmKeysReadAndUnsealBackupLKeyPkg
BlVsmKeysReadAndUnsealLKeyPkg
BlVsmKeysSupportedByPlatform
BlpPdQueryData
BlpPdReleaseData
BlpVsmLKeyCheckBootmgrAuthorityInTcgLog
DbgLoadImageSymbols
DbgPrint
HvlQueryConnection
KdNetGetNetDataSize
KdNetGetParameters
LdrInitSecurityCookie
McGenEventWriteBoot
MinCrypL_HashMemory
MincryptSetWeakCryptoPolicy
OslGenRandomBytes
OslGetControlSubkey
OslGetDrtmSvn
OslGetExportRoutineInModule
OslGetLocalApicId
OslGetStringValueAtKey
OslGetSubkeyAtKey
OslGetValueAtKey
OslIsRunningInSecureKernel
OslLoadMicrocodeUpdate
RtlAnsiStringToUnicodeString
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
RtlApplyFunctionOverrideFixupsToImage
RtlApplyHotPatch
RtlAssert
RtlCheckCurrentPatchesApplied
RtlClearAllBits
RtlCompareMemory
RtlCompareUnicodeString
RtlCompareUnicodeStrings
RtlCountRequiredHotPatchAddressTableEntries
RtlEqualUnicodeString
RtlFindClearBits
RtlFindExportedRoutineByName
RtlFindHotPatchBase
RtlFindHotPatchInformation
RtlFindNextForwardRunClear
RtlFreeAnsiString
RtlFreeUnicodeString
RtlGUIDFromString
RtlImageDirectoryEntryToData
RtlImageNtHeaderEx
RtlInitAnsiString
RtlInitFunctionOverrideCapabilities
RtlInitUnicodeString
RtlInitUnicodeStringEx
RtlInitializeBitMap
RtlInitializeBootFeatureConfigurations
RtlInitializeDelayedFeatureUsageReportBuffer
RtlIntegerToUnicodeString
RtlIpv6StringToAddressW
RtlNotifyFeatureUsage
RtlNumberOfSetBits
RtlPrefixUnicodeString
RtlQueryFeatureConfiguration
RtlQueryFeatureConfigurationChangeStamp
RtlRbInsertNodeEx
RtlRbRemoveNode
RtlRegisterFeatureConfigurationChangeNotification
RtlSecureZeroMemory
RtlSetBit
RtlSetBits
RtlSizeOfDelayedFeatureUsageReportBuffer
RtlStringFromGUID
RtlUnicodeStringToAnsiString
RtlUnicodeStringToInteger
RtlUnregisterFeatureConfigurationChangeNotification
RtlUpcaseUnicodeChar
RtlValidateDelayedFeatureUsageReportBuffer
RtlValidateFeatureConfigurationBuffer
RtlValidateFeatureUsageSubscriptionBuffer
RtlValidateHotPatchBase
SIPolicyClearAllActivePolicy
SIPolicyDeletePersistentVariable
SIPolicyGetOptions
SIPolicyGetPolicyHandle
SIPolicyGetPolicyInfoFromType
SIPolicyGetSerializedPolicies
SIPolicyGetSerializedPoliciesSize
SIPolicyHashActiveCodeExecutionPolicies
SIPolicyInvalidateEAsOnRebootEnabled
SIPolicyIsPolicyActive
SIPolicyIsSamePolicyID
SIPolicyIsSignedPolicyRequired
SIPolicySetTrialMode
SIPolicyUmciEnabled
SbArePolicyOptionsSet
SbDoesActivePolicyGrantPermission
SbFreeFileData
SbGetKernelPolicyPackage
SbGetSizeOfKernelPolicyPackage
SbIsDebugPolicyActive
SbIsEnabled
SbIsEnabled2
SbIsPolicyActive
SbIsTestRootTrusted
SbIsTestSigningBlocked
SbLoadFile
SbValidateSkuUnlockToken
SipaGetDataPointers
SipaQueueConfigEntry
SipaQueueConfigEntryToQueue
SipaReadPcrsByMask
SipapAppendEntry
SipapCreateQueue
SymCryptGcmAuthPart
SymCryptGcmDecryptFinal
SymCryptGcmDecryptPart
SymCryptGcmEncryptFinal
SymCryptGcmEncryptPart
SymCryptGcmExpandKey
SymCryptGcmInit
SymCryptHmacSha256
SymCryptHmacSha256ExpandKey
SymCryptHmacSha512Selftest
SymCryptInit
SymCryptMarvin32
SymCryptMarvin32ExpandSeed
SymCryptRdrandGet
SymCryptRdrandStatus
SymCryptRdseedGet
SymCryptRdseedStatus
SymCryptRngAesFips140_2Generate
SymCryptRngAesFips140_2Instantiate
SymCryptRngAesFips140_2Uninstantiate
SymCryptRngAesGenerateSelftest
SymCryptRngAesInstantiateSelftest
SymCryptRngAesReseedSelftest
SymCryptSha1
SymCryptSha256
SymCryptSha256Append
SymCryptSha256Init
SymCryptSha256Result
SymCryptSha512
SymCryptSha512Append
SymCryptSha512Init
SymCryptSha512Result
SymCryptSp800_108
TpmApiCheckSecureNVIndex20
TpmApiCreateSecureNVIndex20
TpmApiCreateSrk20
TpmApiGetKeyPublicProperty20
TpmApiGetTpmVersion
TpmApiReadPublic20
TpmApiSeal20Ex
TpmApiTestAes256Capability20
TpmApiTestRsa3kCapability20
TpmApiUnsealEx
__GSHandlerCheck
__chkstk
_snwscanf_s
_stricmp
_strupr
_vsnprintf
_wcsicmp
_wcsnicmp
_wcstoui64
_wcsupr
bsearch
memcmp
memcpy
memmove
memset
qsort
rsa_construction_fips186_3
rsa_decryption
rsa_destruction
rsa_encryption
rsa_export
rsa_export_sizes
sprintf_s
strcat_s
strchr
strcmp
strcpy_s
strncmp
strnlen
strstr
swprintf_s
wcscat_s
wcscmp
wcscpy_s
wcsncmp
wcsnlen
wcsrchr
wcsstr
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ